FluentD loki plugin: add support for bearer_token_file parameter #2739
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## master #2739 +/- ##
==========================================
+ Coverage 61.39% 61.47% +0.07%
==========================================
Files 173 173
Lines 13465 13465
==========================================
+ Hits 8267 8277 +10
+ Misses 4445 4433 -12
- Partials 753 755 +2
|
jgehrcke
commented
Oct 8, 2020
| validate_client_cert_key | ||
| end | ||
|
|
||
| raise "bearer_token_file #{@bearer_token_file} not found" if !@bearer_token_file.nil? && !File.exist?(@bearer_token_file) |
There was a problem hiding this comment.
self review: need to remove that line
|
👋 @jgehrcke, small world 🙂 |
cyriltovena
approved these changes
Oct 16, 2020
Hello @jeschkies -- so cool! Grafana Labs should be honored to have you (: small world, indeed!
@cyriltovena we're good here, I think you can merge this! Works fine in our testing. Happy to submit follow-up patches as we think they're necessary. |
I'm honored ❤️ |
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request adds a configuration parameter
bearer_token_filefor the Loki FluentD plugin.The value is expected to be a file path. When specified, the corresponding file is read (once, during startup). The content is assumed to be an authentication token. In all subsequent POST HTTP requests towards the Loki API, the plugin then sets an HTTP header of the shape
Authorization: Bearer <token>.In the cloud native ecosystem the
Bearerauthentication scheme gains more and more popularity(*) for communicating authentication proof within HTTP requests, and it is not uncommon to have an authenticator in front of the Loki API that requires the presentation of such authentication proof.The name of the configuration parameter and the concept in general is inspired by Prometheus'
bearer_token_fileparameter, documented here: https://prometheus.io/docs/prometheus/latest/configuration/configuration/In addition to this feature change, this PR also contains
Two new log statements in action (helping with debugging)
Security note: the token itself is sensitive data, and with the file-based approach the FluentD config document can stay non-sensitive, and the FluentD log will also not show the value of the token (at least not that I am aware of).
*: TheBearerscheme was once reserved for usage in the context of OAuth2, see https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml and https://tools.ietf.org/html/rfc6750. But it has morphed into something more generic in the meantime, at least in practice.Which issue(s) this PR fixes:
I did not create an issue for this, can do if desired :-).
Special notes for your reviewer:
Checklist